Systems and methods for detecting and managing the unauthorized use of an unmanned aircraft

ABSTRACT

A method for policing and managing the operation of a flying, unmanned aircraft in the event of usurpation of control of, malfunction of, or ill-intentioned use of, this aircraft includes the steps of (a) detecting inappropriate operation of the aircraft; (b) transmitting a takeover command to the aircraft to interrupt control of the operation of this aircraft by a first pilot and relinquish control of the aircraft to a second pilot; and (c) transmitting control commands to the aircraft to control its operation by the second pilot, until the need for alternate pilot control of the aircraft has ended or until the aircraft has landed safely.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority from provisional application No.60/842,600 filed Sep. 6, 2006. This application also incorporates byreference U.S. Pat. No. 6,917,863 and each of U.S. patent applicationSer. Nos. 10/919,169, 11/373,712, 11/385,270 and 11/388,311.

This application is a continuation of U.S. patent application Ser. No.11/899,827 filed Sep. 6, 2007 (now U.S. Pat. No. 7,835,824 issued Nov.16, 2010).

BACKGROUND OF THE INVENTION

The present invention concerns a method and apparatus for “policing”unmanned aircraft, such as “umanned aerial vehicles” (UAs) and “unmannedaerial systems” (UASs). The invention is specifically directed to theproblems posed by (1) a usurpation of control of an unmanned aircraft byan unauthorized third party, (2) the operation of a malfunctioningunmanned aircraft, and/or (3) the ill-intentioned use of an unmannedaircraft thus posing a danger to person and/or property.

SUMMARY OF THE INVENTION

The systems and methods described herein are intended to prevent the useof unmanned aircraft, e.g. UAs and UASs, hereinbelow “UA”, forunauthorized and possibly ill-intentioned purposes.

The approaches to such prevention include:

A) Approach #1: Failure to provide a unique identification or passwordon request makes the UA subject to destruction.This approach requires:

1) that all UA have a unique identification, “UI”, consisting of digits,numbers, both or any reproducible information carrying identifier; and

2) that such identification is either permanently unalterable, oralterable only by an authorized person or entity; and

3) that such identification must be able to be presented at any timethat an authorized person or entity requests;

The UI may be either:

1) supplied to the UA at the time of aircraft manufacture, or some latertime substantially prior to takeoff;

2) supplied to the UA immediately prior to takeoff. Such pre-takeoff UIsupply approaches parallel the encryption key supply approachesdescribed in U.S. Pat. No. 6,917,863, and include generation of the UI:

-   -   a) onboard the UA;    -   b) from a remote control center “RCC”; or    -   c) from a freestanding UI generation device; or

3) both: In this case the UI is supplied at some early instance and apassword, “PW”, is supplied immediately prior to takeoff. The passwordmay have the same three possible sources as the UI.

A request for UI or PW presentation may be made at the time of takeoff,or at any time during a UA flight. If there is either no response or anincorrect response, corrective actions include:

1) dispatch an interceptor aircraft, “IAC”, which may:

-   -   a) further/better identify the UA; and/or    -   b) determine that the UA flight should be terminated.

If flight termination is selected, IAC options include:

-   -   a) disable or shoot down the UA using a weapon system aboard the        IAC; or    -   b) activate a self-destruct system—if included in the UA design        [discussed hereinbelow]; and

2) activate a self-destruct system—if included—from the RCC.

B) Approach #2: Failure to comply with a pre-registered flight planmakes the UA subject to destruction.In this approach, the UA is required to file a flight plan prior totakeoff. If the flight plan is unacceptable, takeoff is unauthorized,and any of the means for aircraft destruction or incapacitationdiscussed hereinabove and hereinbelow may be enacted.Methods of monitoring compliance with the flight plan during flightinclude:

1) Equipment onboard the UA, continually compares the UA position asderived from GPS data or other aircraft locating means as is known inthe art, (and the UA velocity vector) with the expected one, based onthe flight plan. Any significant deviation from the flight plan is thusdetected by onboard equipment and transmitted to an authority at a RCC,who has the options of further observation, investigation or action asdescribed hereinabove;

2) The UA reports only a continuous, semi-continuous or intermittentstream of GPS data (or reports it on request). Personnel within the RCCthen compare such data with either:

-   -   a) the previously filed flight plan;    -   b) known no-fly zones; or    -   c) both a) and b).        If the position or track of the UA is deemed unsatisfactory, RCC        authority options are as stated above.

3) Visual or radar sightings of the UA are compared with either:

-   -   a) the previously filed flight plan;    -   b) known no-fly zones; or    -   c) both a) and b).

If the position or track of the UA is deemed unsatisfactory, RCCauthority options are as stated above. The sighting information isobtained by any of the following “monitoring means”:

-   -   a) other aircraft, including:        -   i) passenger, commercial or military aircraft who site the            UA incidentally;        -   ii) other UA, which are in place to police UA (and other)            air traffic;        -   iii) an IAC, if dispatched; and    -   b) terrestrial stations, including RCCs and air traffic control        installations;        Furthermore, the UA may carry a locator beacon which assists        tracking of it and serves a purpose similar to that of        visual/radar sightings.

In a preferred embodiment of the invention, Approach #2 is carried outwith a UA with a UI (with or without a PW). (If the UA transmits itslocation and/or transmits deviations from flight plan, the transmissionis meaningless without a UI.) Obviously, remotely controlled destructionrequires a UI.

In an alternate embodiment of the invention, an aircraft which does nothave a UI, which is detected by any of the aforementioned monitoringmeans may be requested to present a flight plan. Such request may betransmitted to it by

1) an IAC in close proximity, on a recognized/commonly agreed uponfrequency allocation; or

2) a non-local RCC, on such a frequency allocation, in which casecoordinates with sufficient precision to identify the UA in questionwould be used as the identifier.

Failure to comply with the request for flight plan would result ineither:

1) destruction of the UA; or

2) escort of the UA by the IAC until such time as:

-   -   a) the UA is no longer deemed to be a threat; or    -   b) a decision is made to destroy the UA.        C) Approach #3: Each UA is required to allow itself to be        controlled by an alternate pilot, upon the request of the        alternate pilot. The alternate pilot, representing a        known/safe/recognized/responsible authority can:

1) test whether the UA has such capability; and

2) if necessary, assume control of the UA.

This approach allows policing of UAs by adding the option of alternatepilot, “Alt-P”, control. The alternate pilot controls the UA by anymeans of information exchange as is known in the art includingradiofrequency, optical, and infrared means.

The Alt-P first determines whether the aircraft is controllable by theAlt-P. This may be determined in one or more of the following ways:

1) The Alt-P may interrogate the UA and determine from it's UI whetherthe UA is controllable. To do this, the Alt-P may access a databasecontaining the UIs of known controllable UAs.

2) The Alt-P may send a test signal on a frequency and with modulationand coding format known to be used for UAs. If the UA is a controllableone, the UA sends back a confirmation signal indicating that it iscontrollable.

3) The Alt-P may send a test control signal on a frequency and withmodulation and coding format known to be used for UAs. The test controlsignal includes a flight control command which results in a test motion(e.g. momentarily roll five degrees one way and then momentarily rollfive degrees the other way and then return to previous course). TheAlt-P confirms that the desired result has occurred by either:

-   -   a) visual inspection, if the Alt-P is in the near vicinity of        the UA; or    -   b) a telemetry signal from the UA, originating from sensors        within the UA.

Test control signals may control pitch, yaw, throttles, etc.

If the Alt-P deems necessary, the Alt-P may take control of the UA andfly it to an appropriate destination.

If the Alt-P determines that the UA has been modified (e.g. postproduction, or even post take-off) so that the Alt-P cannot fly the UAin a way that was allowed for in the initial specifications, the Alt-Pmay take action to cause the destruction of the UA. (If not in visualrange of the UW the Alt-P can make such a determination with a UA thathas a UI.) If the UA was not designed to be controllable by an Alt-P,the Alt-P will then decide (based on existing regulations concerningcontrollability of a UA, and based on the actions of the particular UA)whether to allow the current UA flight to continue.

The Alt-P may be located within the vicinity of the UA, or at a greaterdistance. In parallel to the discussions of remote aircraft control inU.S. Pat. No. 6,917,863 and in U.S. patent application Ser. Nos.10/919,169 and 11/373,712, the advantage of limiting Alt-P actions tolocal Alt-Ps is the security means available to a short rangecommunications link (i.e. using methods such as a high output controllertransmitter and a low sensitivity UA receiver, and using highlydirectional transmission/reception means). A short range communicationslink is therefore much less likely to be accessed by an unauthorizedperson than is a long range link. The advantage of using a long rangelink is that it can be accessed immediately, upon the detection of asuspicious UA; the delays implicit in

1) sending an IAC; and

2) awaiting its arrival at the vicinity of the UA

are not encountered.

UAs which allow Alt-P systems give the UA policing community anotheroption beyond either:

1) further observe the UA; or

2) destroy the UA.

Alt-P systems may be used with or without UI/PW systems and with orwithout systems which compare aircraft position and velocity vectorswith those called for by the flight plan.

The aforementioned system functions are enabled/facilitated and renderedmore secure/robust by sub-systems including:

-   -   tamper detecting seals;    -   write-once-only-memory (e.g. so called PROMs (programmable        read-only memories), EPROMs, EEPROMs, etc. as are known in the        art, and as are, hereinbelow referred to as “XPROMs”);    -   encryption/encoding circuits and techniques;    -   destructive means aboard the UA.        These are further discussed hereinbelow.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1, comprising FIGS. 1A and 1B in combination shows a flow diagramof the operation of an algorithm for the policing of UAs.

FIG. 2 shows a block diagram for determining the source of control of aUA.

FIG. 3 shows another block diagram for determining the source of controlof a UA.

FIG. 4 shows a system of highly directional transmission between a UAand an aircraft for policing UAs.

FIG. 5 shows another system of highly directional transmission between aUA and an aircraft for policing UAs, which includes a terrestrialstation.

FIG. 6 shows a block diagram of apparatus for policing UAs.

FIG. 7 shows a block diagram of apparatus aboard a UA which allows it tobe policed.

FIG. 8 shows a block diagram of apparatus aboard a UA which allows theassessment of its response to a policing authority command.

FIG. 9 shows a block diagram of apparatus aboard a UA which allows itsdestruction, if appropriately commanded.

FIG. 10 shows apparatus to be used by a policing authority, foridentifying UAs which may need assessment, because of potential,possible or actual inappropriate behavior by the UA.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 1 consists of FIG. 1A and FIG. 1B, and shows an algorithm forpolicing UAs. The algorithm begins with block 10, an indication of apossibly improper UA. The basis of the impropriety could be:

a) information provided to a policing authority (PA) from one of manypossible sources of security information;b) information from a computer (or person who operates the computer),which tracks the position of UAs;c) information from a computer (or person who operates the computer),which tracks the flight plans of UAs;d) information from a computer (or person who operates the computer),which compares the positions and flight plans of UAs; ande) GPS or radar or other sighting information (from a ground-based,sea-based, air-based or space-based observer or observation apparatus,indicating encroachment of a UA into a sensitive space.

“Possible T.O. Trigger” 10 indicates an indication, such as listedhereinabove, for possible takeover (TO) of the UA. The takeover wouldresult in

a) removal of the UA pilot (first pilot herein) control; andb) institution of control by either a local or remote pilot (secondpilot) who is part of a PA.

In one embodiment of the invention, the first pilot PA checks theidentification of the UA, block 12. The check could entail any one of avariety of methods known in the art, including:

a) interrogating an identifying device aboard the UA; andb) observing the exterior of the UA, which may include:

-   -   i) identifying alphanumeric or other surface based pattern,        using visible light;    -   ii) using a laser to identify coded paint, as is known in the        art.

The interrogation of the identifying device, above, may take place byradiofrequency communication on a channel which has been designatedspecifically for the purpose of UA identification (ID) and policing. Ifone or more such channels are allocated, the PA may need to attemptcommunication on each such channel. The ideal situation would bestatutory requirement that every UA (or almost every UA) be outfittedwith equipment which allows communication on a known, agreed uponchannel, using an agreed upon communication protocol known to at leastthe PA and the UA operator.

At block 14, the PA determines if the ID is acceptable. Suchdetermination may be based on:

a) a list, appropriately disseminated, of properly registered UAs;and/orb) a list, appropriately disseminated, of UAs which are on a “watchlist,” indicating the potential for inappropriate UA behavior.

If the ID is acceptable, block 16, the PA:

a) may end the communication encounter, in which case the PA options,block 18, would be:

i) ending the observation of this particular UA; or

ii) continuing observation (with some enhancement of the level ofsurveillance above that of other UAs), with or without escorting thevehicle. If the PA is aboard an aircraft in proximity to the UA, suchescorting may begin promptly. If the PA is not in proximity to the UA,escorting may consist of dispatching a chase aircraft which flies to thelocation of the UA and stays in proximity until there is no longer anyneed for escort.

If the identification is unsatisfactory, or if—at block 16—the PAchooses not to end the communications encounter with the UA, the PA,block 20, may request one or more of:

a) a UA flight plan;b) the UA GPS history (i.e. a history of each previous location that theUA has been, indicated by space and time coordinates); andc) a comparison of the UA flight plan and the GPS history, thecomparison indicating whether the UA has complied with its flight plan.

Each of a) b), and c) may be stored in a memory unit within the UA, orstored in a ground based facility that tracks UAs, see hereinbelow.

If the PA finds that the flight plan, the GPS history, and/or thecomparison of the two is acceptable, then block 22 leads to 24, at whichpoint the PA may choose to end the communications encounter, withoptions then per block 18, as discussed hereinabove.

If (a) the flight plan/GPS history analysis yields unsatisfactoryresults, or is not responded to at block 22: or if (b) at block 24 thePA decides that not enough information has been presented to reach adecision about whether the UA flight should be allowed to continue underthe control of the first pilot, then, at block 26, the PA requestscommunications information from the UA. This information may include oneor more of:

a) the frequency or channel on which the UA transmits telemetry to theUA pilot;b) the frequency or channel on which the UA receives commands from theUA pilot;c) the system or methodology that the UA and the UA pilot use forchannel hopping;d) the system or methodology that the UA and the UA pilot use forencoding and decoding exchanged information;e) the system or methodology that the UA and the UA pilot use forencrypting and decrypting exchanged information;f) passwords, if any; andg) any other communication formatting or executing information necessaryfor the PA pilot to fly the UA.

The step of requesting the communications information may come earlierin the algorithm shown in FIG. 1. It may come between blocks 10 and 12,or it may come immediately before block 20. Furthermore, the request forinformation may be from another UA or the pilot of another UA.

If the requested information is not supplied, block 28 to block 32, thePA options include:

a) escorting the UA (with the option of more aggressive action at alater time);b) destroying the UA;c) requesting instructions from a higher authority; andd) attempting communication with the UA; If this leads to establishmentof a working communications link, the algorithm proceeds as describedhereinbelow for block 34; If this does not lead to a working link,options a), b) and c) remain as choices.

The attempt d) may entail a trial-and-error effort to determine theneeded communication parameters, or may entail use of information storedin a database.

The PA may skip to the options listed in block 32 if an unsatisfactoryresult occurs at the time of either ID checking or the assessment offlight plan and/or GPS history.

If the requested communication information is supplied, block 28 to 30Ato 30B (FIG. 1A, and continuing on FIG. 1B) to 34, the PA sends atakeover command to the UA. In one preferred embodiment of theinvention, the takeover (TO) command causes

a) the UA to allow piloting by the PA;b) the UA to exclude piloting by the UA pilot (the first pilot); andc) the UA to send a confirmation signal that the TO command has beenexecuted. Apparatus which allows for the execution of such a commands ispresented hereinbelow.

In other embodiments of the invention:

a) there may not be a TO confirmation signal;b) there may not be a lockout of the first pilot from control; andc) there may not be a unique TO command; Rather, specific commands (e.g.move rudder by a specific amount) would be sent to the UA.

Referring again to the embodiment in which a confirmation signal is sentwhen a TO command is enacted, if the TO confirmation is not receivedfollowing the transmission of a TO command, block 34 to 36 to 38A to 38B(FIG. 1A) to 32 with options including:

include:a) escorting the UA (with the option of more aggressive action at alater time);b) destroying the UA;c) requesting instructions from a higher authority; andd) again transmitting a TO command.

If a TO confirmation signal is received, block 34 leads to 36 and thento 40, at which time the PA may attempt to execute a test maneuver. Thetest maneuver is the transmission of a command which causes a change inaircraft attitude which may either be directly observed by a local PA(e.g. bank five degrees), or may be detected by apparatus onboard the UA(see below).

The purpose of the maneuver is to attempt to distinguish ill-intentionedUA pilots/vehicles from those with benign intentions; The assumption isthat an ill-intentioned UA pilot would be much less likely to complywith a request to allow takeover of the UA by the PA. (Though it may bethe case that an ill-intentioned UA pilot would not allow for thetransmission of information requested in blocks 12, 20 and 26, suchdenials are dealt with by the algorithm [and lead to block 32].) It maybe that an ill-intentioned pilot would have allowed the transmission ofinformation at blocks 12, 20 and 26 hoping to avoid detection.

If the test maneuver is not executed successfully, block 40 leads to 42,then to 38C and then to 38B (in FIG. 1A), with PA options including:

a) escorting the UA (with the option of more aggressive action at alater time);b) destroying the UA;c) requesting instructions from a higher authority; andd) again transmitting a test maneuver.

If the test maneuver is successful (indicating that the PA is indeedcapable, at this point, of piloting the UA) then block 40 leads to 42,and then to 44 with PA options including:

a) the PA, now in control of the UA, flying the vehicle to a more securelocation;b) escorting the UA (with the option of more aggressive action at alater time);c) returning control of the vehicle to the first (i.e. UA) pilot;d) requesting instructions from a higher authority.

The reasoning behind option c) is that if the first pilot permitted eachof the aforementioned steps/requests by the PA, the likelihood of hisbeing an ill-intentioned pilot is substantially decreased, compared tothe pre-evaluation likelihood.

FIG. 2 shows a form of apparatus which may be aboard a UA which allowsfor the aforementioned tasks including the transfer of control from thefirst pilot to the PA following a TO signal, and the transmission of aTO confirmation. The switching apparatus shown is intended to be viewedschematically; though an “old technology” double-pole-double-throw relaymay accomplish the task of switching control from the UA pilot (alsoreferred to herein as “pilot 1”) to the PA (also referred to as “pilot2”), more sophisticated switching arrangements, including computerhardware and/or software based approaches, are possible and are known inthe art.

In the figure, signals to the UA are received by 50, and decoded (anddecrypted, as necessary) by 52. Under ordinary circumstances, the UAfirst pilot control signals 54C pass to the appropriate item to becontrolled 58 (e.g. rudder, throttles etc.) via the path 54C to 56E to56C to 56B to 56A to 58. (The poles in the figure are shown in the otherposition, i.e. allowing control by the PA pilot.)

When the PA wishes to take control of the aircraft, a switch controlsignal is sent along the path 50 to 52 to 54A to 56L. Switch control 56Lcauses the two components of the switch to move to the pilot 2/PA pilot(i.e. the left-most position in the figure). The result is that pilot 1control signals can no longer pass beyond 56E, and that pilot 2 signalscontrol items 58 along the path 50 to 52 to 54B to 56D to 56C to 56B to56A to 58. If, at a later time, the PA is satisfied that control of theUA can safely be returned to the first pilot (option 3 in block 44 ofFIG. 1B), a switch control signal sent to 54A restores control to thefirst pilot.

The switch components 56F, 56G, 56H, 56J and 56K allow the PA to knowthe switch position: Switch position indicator 60 senses which of twopositions the switch is in, via 56F-56K, the information is encoded andpreferably encrypted at 62 and transmitted to the PA by 64.

An alternate embodiment of the switching arrangement is shown in FIG. 3.FIG. 3 differs from FIG. 2 only in that FIG. 3 contain separatereceiver/decoder elements for the pilot #1 signals and for the pilot #2signals. One way of limiting the chance that an unauthorizedperson/hacker could usurp the authority of the PA and attempt to obtaincontrol over a UA would be to use one or more of:

a) high output transmitters for PA control signals;b) low sensitivity receivers for PA control signals;c) highly directional antennae at each end of the PA-UA communicationlink;d) upwardly oriented UA antennae, to communicate with a PA aircraftlocated at a higher altitude than the UA (This might require an antennafor UAV-PA communication which is separate than the one for UA-firstpilot communications. [The separate antenna is not shown in thefigure.]; ande) time dependent varying of the orientation of either the PA antenna orthe UA antenna (with corresponding adjustments by the PA pilot tocompensate for such orientation changes).

In addition, the aforementioned unauthorized controller exclusion wouldemploy encoding and encryption techniques as are known in the art.

Referring again to FIG. 3, first pilot signals are received along thepath 70 to 72 to 74. PA pilot signals are received by a low sensitivityreceiver 76, decoded by 78, thereby giving rise to pilot #2 (PA pilot)control signals 80 and pilot #2 switch control signals 82. Embodimentsof the invention with two receivers (70 and 76) and a single decoder arepossible. Embodiments of the invention which share not only a decoderbut which also share all but the “front end” of the receiver arepossible.

FIG. 4 shows the use of highly directional apparatus aboard the UA 100and a PA aircraft 114A. Control signals 122 are sent from an airborneremote control center 116 via directional antenna 118A aboard 114A todirectional antenna 120. Directional apparatus may also be fortransmission from 100 to 114A.

FIG. 5 shows an embodiment of the invention in which an interceptingaircraft 114B acts as a repeater unit, allow a terrestrial (land orsea-based) remote control network 103 to control a UA 100. Signals tothe UA traverse the path 103 to 113 to 118B to 128 (signal repeaterequipment) to 118A giving rise to signals 122 to 120 to 100. (Thereversed sequence pertains to telemetry and other signals from 100 to103.) Antennae 113 and 118B would be operative to vary their orientationto optimize signal strength based on the positions of 103 and 114B.

FIG. 6 shows apparatus which comprises a preferred embodiment of the PAapparatus for communicating with a UA. The PA inputs commands via inputdevice 140, which are transmitted by 144. The PA receives UA signals via134 which may be linked directly to display device 138, or to 138 vialogic device 136. 136 allows for the comparison, if desired by the PA,of GPS history and intended flight plans. The flight plans may be storedin memory 142 or received at the time that the GPS history is received.142 may also store a list of potentially problematic UAVs, i.e. UAVs tobe watched more carefully than others. 142 may also store flightroutines which allow a PA pilot to fly a UA to a specific destinationwith a minimum of control activity; 140 may input the control signalswhich allow for these flight routines to go directly to 144, or to go to144 from 142. 142 may also serve to record all PA actions that issuefrom 140. The combination of 136 and 142 may act as a flight managementcomputer and/or autopilot for the UA when it is controlled by the PA whoprovides input via 140.

FIG. 7 shows a system aboard the UA which communicates with that of thesystem shown in FIG. 6. The system in FIG. 7 contains

receiver 150, which,

1) on receipt of a suitable signal, 150 causes identification XPROM 152(which is either a PROM, an EPROM, an EEPROM or similarwrite-once-only-memory device as is known in the art) to signaltransmitter 154 (and/or causes transmitter 154 to send the UI containedin 152);

2) on receipt of another type of signal, and of flight plan information,causes the writing of flight plan information into flight plan XPROM156;

3) on receipt of another type of signal, causes the transmission offlight plan information from 156 to 154 to the PA;

4) on receipt of another type of signal, causes the transmission ofcommunications information from XPROM 153 to 154 to the PA;

5) on receipt of another type of signal, causes the transmission ofreal-time GPS information from 158 to 154 and then to the UA;

6) on receipt of another type of signal, causes the transmission ofeither:

-   -   i) GPS history stored in 160, to 154, to the PA;    -   ii) a comparison of the GPS history stored in 160 and the flight        plan information, to 154, to the PA.

160 may be a computer, part of a computer, a microprocessor, part of amicroprocessor or a logic device or system of logic devices as is knownin the art. GPS or other locator system information may be:

a) transmitted to a remote control center (RCC);b) used as a basis for assessing compliance with the flight plan. TheGPS data may be used to generate both the expected UA position and theexpected UA velocity.

160 may cause the transmission of:

a) all “raw data” related to the comparison of GPS data and the flightplan;b) only the results of such comparisons that indicate significantdeviation from the flight plan.

In a preferred embodiment of the invention, the apparatus consisting ofelements 150 through 160 is enclosed within tamper detecting seal (TDS)162.

FIG. 8 shows apparatus aboard the UA which allows the RCC to determineif a test command sent by it has been received and executed. Not shownin the figure is:

a) the receiver which receives the command;b) the aircraft apparatus which carries out the command; andc) the linkage between a) and b).

If and when the command is executed, one of roll detector 200, pitchdetector 202 or yaw detector 204 will register a change in sensed inputcorresponding to which of these was associated with the test command.(Other test commands are possible.) The output of these detectors istransmitted at 206. In a preferred embodiment of the invention, thetransmission is accompanied by a UI from XPROM 208. In a preferredembodiment of the invention, the apparatus comprising elements 200-208is enclosed in TDS 210.

FIG. 9 shows an apparatus which allows remotely triggered destruction ofa UA. The apparatus is enclosed in TDS 220. Transmitter 222 confirms theidentity of the UA with a UI from 224. In the event that an authorizedperson determines that it is not appropriate for the UA to continue itsflight, and in the event that such authorized person does not wish to orcannot take control of the UA as a second pilot and fly it to anappropriate destination, the authorized person would have the option ofdestroying or incapacitating the UA using apparatus aboard the UA shownin the figure.

If the authorized person makes a destruct decision, a destruct signal,“DS” is sent. The DS is received by 225, from which, after appropriatedecoding and decryption, a destruct signal is generated, indicated byelement 226. Four options for executing such destruction are illustratedin the figure:

a) 228, indicating apparatus for interrupting electrical powerdistribution to critical elements within the UA;b) 230, indicating apparatus for the interruption of fuel flow withinthe UA;c) 232, indicating apparatus for interrupting the linkage to movingaircraft control elements (throttle, rudder, ailerons, flaps, etc.); andd) 234, indicating one or more explosive charges carried by the UA,which may be detonated in response to a signal 226.

FIG. 10 shows apparatus with which a remote control center (eitherterrestrial or airborne) may determine whether UA location and/or UAflight plans are appropriate. Receiver or datalink 240 receives fourtypes of information:

a) filed flight plans 242;b) GPS information 244, transmitted from GPS apparatus aboard UAs;c) UA sighting information 246 (e.g. other aircraft reporting on thepresence of a particular UA at a particular time and location); andd) deviation signals 248 (such as those generated by element 160 in FIG.7).

Comparison computer microprocessor/logic system 250 compares:

a) actual UA position information from 244 and 246 with expected UAposition information from 242;b) actual UA position information with known “no-fly” zones (stored indatabase 252); andc) filed flight plans with no-fly locations.

254, i.e. (A) 248, and (B) the output of 250, indicating any of thethree types of aforementioned deviations are displayed by 256. In apreferred embodiment of the invention, the display may also indicate oneor more of:

a) the UI of the deviated UA;b) the magnitude of the deviation;c) historical information about the flight: i.e. details about theportions of the flight, if any, prior to the deviation;d) historical information about the particular UA including:

1) prior flights; and

2) the owner; and

e) enroute weather information for the UA, as a possible explanation foran off-course location.

The airspace may be patrolled for inappropriate UA activity by:

a) existing patrol networks;b) one or many unmanned aircraft for the specific purpose of policingUAs;c) one or many manned aircraft whose primary purpose is eitherpassenger/commercial or military, but which may be outfitted with UApolicing equipment; andd) combinations of a), b) and c).

There has thus been shown and described a novel method and apparatus formanaging unauthorized use of an unmanned aircraft which fulfills all theobjects and advantages sought therefor. Many changes, modifications,variations and other uses and applications of the subject inventionwill, however, become apparent to those skilled in the art afterconsidering this specification and the accompanying drawings whichdisclose the preferred embodiments thereof. All such changes,modifications, variations and other uses and applications which do notdepart from the spirit and scope of the invention are deemed to becovered by the invention, which is to be limited only by the claimswhich follow.

1.-26. (canceled)
 27. A method of policing and managing the operation ofa flying, unmanned, first aircraft in the event of usurpation of controlof, malfunction of, or ill-intentioned use of, said first aircraft, saidfirst aircraft being controlled remotely by a first pilot, not presenton said first aircraft, said method comprising the steps of: (a)detecting inappropriate operation of said first aircraft by means of thesteps of: (1) obtaining an identification information of the firstaircraft; (2) checking the identification information of the firstaircraft against a database of preregistered identification information;and (3) determining if the first aircraft is authorized to fly; (b) ifinappropriate operation is detected, transmitting a takeover command tosaid first aircraft to interrupt control of the operation of said firstaircraft by said first pilot currently in control of said firstaircraft; and (c) a second pilot, also not present on said firstaircraft, transmitting control commands to said first aircraft tocontrol the operation of said first aircraft, while excluding operationof said first aircraft by said first pilot, until the need for secondpilot control of the first aircraft has ended or until said firstaircraft has landed safely.
 28. The method defined in claim 27, furthercomprising the initial step of providing a transmission link by andbetween a first transmitting and receiving device (“first T/R device”)on the first aircraft and a second transmitting and receiving device(“second T/R device”) in a control station separate from said firstaircraft thereby permitting communication between said first aircraftand said control station.
 29. The method defined in claim 28, whereinsaid takeover command is transmitted from a first control station whichis located on the ground to said first aircraft.
 30. The method definedin claim 28, wherein said control commands are transmitted from a secondcontrol station which is located on the ground to said first aircraft.31. The method defined in claim 27, further comprising the initial stepof flying a second aircraft to within the vicinity of the firstaircraft, thereby permitting visual observation of the first aircraft.32. The method defined in claim 28, wherein said takeover command istransmitted from a third control station which is located on a thirdaircraft to said first aircraft via said transmission link.
 33. Themethod defined in claim 28, wherein said control commands aretransmitted from a fourth control station which is located on a fourthaircraft to said first aircraft.
 34. The method defined in claim 28,wherein said step of detecting inappropriate operation further includestransmitting an interrogation command to said first aircraft anddetermining whether a response thereto, if any, is satisfactory.
 35. Themethod defined in claim 28, wherein said identification informationincludes at least one of (a) the identification number of said firstaircraft; (b) aircraft owner identification information; (c) aircraftowner contact information; (d) aircraft pilot identificationinformation; and (e) aircraft pilot contact information.
 36. The methoddefined in claim 34, wherein said first aircraft includes meansincluding an altimeter and a GPS device for determining informationpertaining to a current location in space of said first aircraft, andwherein a satisfactory response to said interrogation command comprisesthe step of transmitting information to said control station pertainingto said current location which matches the current position of saidfirst aircraft.
 37. The method defined in claim 34, wherein said firstaircraft further includes a memory in which is stored informationpertaining to a current flight plan of the first aircraft, and wherein asatisfactory response to said interrogation command comprises the stepof transmitting information pertaining to the flight plan which matchesa previously registered flight plan.
 38. The method defined in claim 37,wherein said first aircraft includes means including an altimeter and aGPS device for determining information pertaining to a current locationin space of said first aircraft, further comprising the step ofcomparing said information pertaining to said current location of saidfirst aircraft with said information pertaining to the flight plan, andwherein the response to said interrogation command comprises the step oftransmitting said information pertaining to the comparison of saidlocation and said flight plan, and transmitting said takeover command ifsaid location does not correspond to the flight plan.
 39. The method ofclaim 34, wherein said interrogation command is a request to provide atleast one type of communication information selected from among thegroup consisting of: a) at least one of the frequencies forcommunication with said first aircraft; b) at least one of the channelsfor communication with said first aircraft; c) the format forcommunication with said first aircraft; and d) the method of encodingcommands transmitted to said first aircraft; and wherein a satisfactoryresponse is defined as the receipt of said communication information;40. The method of claim 34, wherein said interrogation command is acommand to execute a change in one of the movable surfaces of the firstaircraft and wherein an appropriate response is at least one of (i) amovement of a moveable surface of said first aircraft, and (ii) amovement of said first aircraft, in correspondence with a command toexecute a change in said moveable surface.
 41. The method defined inclaim 28, further comprising the step of transmitting data from saidfirst aircraft to said second pilot wherein said data includesinformation pertaining to the flight of said first aircraft and saidcontrol commands are based on said information.
 42. The method definedin claim 41, wherein said first aircraft includes means including analtimeter and a GPS device for determining information pertaining to acurrent location in space of said first aircraft, and wherein said dataincludes said information pertaining to said location.
 43. The methoddefined in claim 41, wherein said first aircraft includes a video cameraand wherein said data includes video information obtained by said firstaircraft.
 44. The method defined in claim 28, further comprising thestep of providing a transmission link by and between a thirdtransmitting and receiving device (“third T/R device”) at said controlstation and a fourth transmitting and receiving means (“fourth T/Rdevice”) at an additional control station, thereby permittingcommunication between said control station and said additional controlstation, whereby said control station serves as a repeater station forcommunications between said additional control station and said firstaircraft.
 45. The method defined in claim 28, wherein said controlstation comprises a flight control station to enable said second pilotaboard said second aircraft to control said first aircraft.
 46. A methodof policing and managing the operation of a flying, unmanned, firstaircraft in the event of usurpation of control of, malfunction of, orill-intentioned use of, said first aircraft, said first aircraft beingcontrolled remotely by a first pilot, not present on said firstaircraft, said method comprising the steps of: (a) detectinginappropriate operation of said first aircraft by means of the steps of:(1) obtaining aircraft flight information pertaining to the firstaircraft; (2) checking said identification information against adatabase of aircraft flight information; and (3) determining if thefirst aircraft is authorized to fly in accordance with said obtainedflight information; (b) if inappropriate operation is detected,transmitting a takeover command to said first aircraft to interruptcontrol of the operation of said first aircraft by said first pilotcurrently in control of said first aircraft; and (c) a second pilot,also not present on said first aircraft, transmitting control commandsto said first aircraft to control the operation of said first aircraft,while excluding operation of said first aircraft by said first pilot,until the need for second pilot control of the first aircraft has endedor until said first aircraft has landed safely.
 47. The method definedin claim 46, further comprising the initial step of providing atransmission link by and between a first transmitting and receivingdevice (“first T/R device”) on the first aircraft and a secondtransmitting and receiving device (“second T/R device”) in a controlstation separate from said first aircraft thereby permittingcommunication between said first aircraft and said control station. 48.The method defined in claim 47, wherein said takeover command istransmitted from a first control station which is located on the groundto said first aircraft.
 49. The method defined in claim 47, wherein saidcontrol commands are transmitted from a second control station which islocated on the ground to said first aircraft.
 50. The method defined inclaim 46, further comprising the initial step of flying a secondaircraft to within the vicinity of the first aircraft, therebypermitting visual observation of the first aircraft.
 51. The methoddefined in claim 47, wherein said takeover command is transmitted from athird control station which is located on a third aircraft to said firstaircraft via said transmission link.
 52. The method defined in claim 47,wherein said control commands are transmitted from a fourth controlstation which is located on a fourth aircraft to said first aircraft.53. The method defined in claim 47, wherein said step of detectinginappropriate operation further includes transmitting an interrogationcommand to said first aircraft and determining whether a responsethereto, if any, is satisfactory.
 54. The method defined in claim 53,wherein said step (a) further comprises the step of obtaining aircraftidentification information, and wherein (1) said identificationinformation includes at least one of (a) the identification number ofsaid first aircraft; (b) aircraft owner identification information; (c)aircraft owner contact information; (d) aircraft pilot identificationinformation; and (e) aircraft pilot contact information, and (2) asatisfactory response to said interrogation command comprises the stepof transmitting information to said control station pertaining to saididentification information which matches respective identificationinformation in a database.
 55. The method defined in claim 53, whereinsaid first aircraft includes means including an altimeter and a GPSdevice for determining aircraft flight information pertaining to acurrent location in space of said first aircraft, and wherein asatisfactory response to said interrogation command comprises the stepof transmitting said aircraft flight information to said control stationpertaining to said current location which matches the current positionof said first aircraft in a database of aircraft flight positions. 56.The method defined in claim 53, wherein said first aircraft furtherincludes a memory in which is stored aircraft flight informationpertaining to a current flight plan of the first aircraft, and wherein asatisfactory response to said interrogation command comprises the stepof transmitting said aircraft flight information pertaining to theflight plan which matches a previously registered flight plan in adatabase of aircraft flight plans.
 57. The method defined in claim 56,wherein said first aircraft includes means including an altimeter and aGPS device for determining information pertaining to a current locationin space of said first aircraft, further comprising the step ofcomparing said information pertaining to said current location of saidfirst aircraft with said information pertaining to the flight plan, andwherein the response to said interrogation command comprises the step oftransmitting aircraft flight information pertaining to the comparison ofsaid location and said flight plan, and transmitting said takeovercommand if said location does not correspond to the flight plan.
 58. Themethod of claim 53, wherein said interrogation command is a request toprovide at least one type of communication information selected fromamong the group consisting of: a) at least one of the frequencies forcommunication with said first aircraft; b) at least one of the channelsfor communication with said first aircraft; c) the format forcommunication with said first aircraft; and d) the method of encodingcommands transmitted to said first aircraft; and wherein a satisfactoryresponse is defined as the receipt of said communication information.59. The method of claim 53, wherein said interrogation command is acommand to execute a change in one of the movable surfaces of the firstaircraft and wherein an appropriate response is at least one of (i) amovement of a moveable surface of said first aircraft, and (ii) amovement of said first aircraft, in correspondence with a command toexecute a change in said moveable surface.
 60. The method defined inclaim 47, further comprising the step of transmitting data from saidfirst aircraft to said second pilot wherein said data includesinformation pertaining to the flight of said first aircraft and saidcontrol commands are based on said information.
 61. The method definedin claim 60, wherein said first aircraft includes means including analtimeter and a GPS device for determining information pertaining to acurrent location in space of said first aircraft, and wherein said dataincludes said information pertaining to said location.
 62. The methoddefined in claim 60, wherein said first aircraft includes a video cameraand wherein said data includes video information obtained by said firstaircraft.
 63. The method defined in claim 47, further comprising thestep of providing a transmission link by and between a thirdtransmitting and receiving device (“third T/R device”) at said controlstation and a fourth transmitting and receiving means (“fourth T/Rdevice”) at an additional control station, thereby permittingcommunication between said control station and said additional controlstation, whereby said control station serves as a repeater station forcommunications between said additional control station and said firstaircraft.
 64. An unmanned aircraft, which is remotely controllable fromeach of a first source of control and a second source of control, saidaircraft comprising: (a) at least one receiving device, for receivinginstruction signals from each of said sources of control; (b) aprocessor, coupled to said at least one receiving device, for receivinginstructions specified by said respective instruction signals and, inresponse to flight instructions received from either source of control,producing operational control signals for the aircraft, and, in responseto control instructions received exclusively from said second source ofcontrol, selecting the source of said flight instructions; and (c) atleast one actuator, coupled to said processor, responsive to saidoperational control signals, for actuating at least one of: (1) at leastone movable control surface of said aircraft, and (2) at least onethrottle, for controlling the fuel supplied to an engine of saidaircraft; wherein: (i) said processor is operative to receive at leastone first flight instruction from said first source of controlspecifying at least one of: (1) a first alteration of at least one ofsaid at least one movable control surface, and (2) a first alteration ofat least one of said at least one throttle; (ii) said processor isoperative to receive at least one second flight instruction from saidsecond source of control specifying at least one of: (1) a secondalteration of at least one of said at least one movable control surface,and (2) a second alteration of at least one of said at least onethrottle; (iii) said processor is operative to receive a first controlinstruction from said second source of control, specifying the actuationof said at least one movable control surface and said at least onethrottle exclusively in accordance with said at least one received firstflight instruction; and (iv) said processor is operative to receive asecond control instruction from said second source of control,specifying the actuation of said at least one movable control surfaceand said at least one throttle exclusively in accordance with said atleast one received second flight instruction; and wherein said processoris operative, in response to said first and second control instructionsfrom said second source of control, to determine which of said firstsource of control and said second source of control controls the flightoperation of the aircraft.
 65. The aircraft defined in claim 64, furthercomprising: (d) at least one sensing device, coupled to said processor,for sensing aircraft data including at least one of the position of amovable control surface and a throttle of the aircraft and supplyingsignals to said processor representing said sensed aircraft data; and(e) a transmitting device, coupled to said processor, for transmittingsignals representing said sensed aircraft data.
 66. The aircraft definedin claim 64, further comprising: (d) at least one additional sensingdevice, coupled to said processor, for sensing additional aircraft dataincluding at least one of: (1) the altitude of the aircraft, (2) thelatitude and longitude of the aircraft, (3) the pitch of the aircraft,(4) the yaw of the aircraft, (5) the roll of the aircraft, (6) the airspeed of the aircraft, (7) the ground speed of the aircraft, (8) therate of ascent of the aircraft, and (9) the rate of descent of theaircraft, and supplying signals to said processor representing saidsensed additional aircraft data; and (e) an additional transmittingdevice, coupled to said processor, for transmitting signals representingsaid sensed additional aircraft data.
 67. A system comprising theapparatus defined in claim 66, and further comprising: (i) a firstremote control unit for providing said at least one first flightinstruction, said first unit comprising: (a) a first transmitting andreceiving (T/R) device; (b) a first input device for manually inputtingfirst flight instructions; (c) a first display device for displayinginformation; and (d) a first processor, coupled to said first T/Rdevice, said first input device, and said first display device, forprocessing and supplying signals representing said instructions to saidfirst T/R device and for processing and supplying signals received bysaid first T/R device to said first display device; and (ii) a secondremote control unit for providing said at least one second flightinstruction and said first and said second control instruction, saidsecond unit comprising: (a) a second transmitting and receiving (T/R)device; (b) a second input device for manually inputting flightinstructions and control instructions; (c) a second display device fordisplaying information; and (d) a second processor, coupled to saidsecond T/R device, said second input device, and said second displaydevice, for processing and supplying signals representing said flightand control instructions to said second T/R device and for processingand supplying signals received by said second T/R device to said seconddisplay device.
 68. The apparatus defined in claim 64, wherein said atleast one movable surface includes at least one of: (a) a flap, (b) anaileron, (c) a rudder, (d) an elevator, (e) a spoiler, and (f) landinggear.
 69. The apparatus defined in claim 66, further comprising amemory, coupled to said processor, for storing and allowing access toinformation.
 70. The apparatus defined in claim 69, wherein (a) saidinformation comprises identification information of said aircraft; and(b) upon receipt of a third control instruction from said second sourceof control, said processor is operative to cause said additionaltransmitting device to transmit a signal representing saididentification information.
 71. The apparatus defined in claim 70,wherein said identification information includes at least one of: (a) anaircraft identification number, (b) aircraft pilot identificationinformation, (c) aircraft owner identification information, (d) aircraftpilot contact information, and (e) aircraft owner contact information.72. The apparatus defined in claim 69, wherein said memory is awrite-once-only memory.
 73. The apparatus defined in claim 69, whereinsaid memory is operative to store flight plan information concerning theintended flight activity of said aircraft, including at least one of:(a) the intended course of the flight of said aircraft, (b) thewaypoints along the route of said intended course, (c) the intendedarrival time for at least one point along said intended course, (d) theintended ground speed for said flight, and (e) the intended loiteringtime at a vicinity along the course of said flight, wherein: uponreceipt of a fourth control instruction from said second source ofcontrol, said processor is operative to cause said additionaltransmitting device to transmit a signal representing said flight planinformation.
 74. The apparatus defined in claim 69, wherein said memoryis operative to store flight information, concerning the actual flightactivity of said aircraft, including at least one of: (a) the actualcourse of the flight of said aircraft, (b) the waypoints along the routeof said actual course, (c) the actual arrival time for at least onepoint along said actual course, (d) the actual ground speed for saidflight, and (e) the actual loitering time at a vicinity along the courseof said flight wherein: upon receipt of a fifth control instruction fromsaid second source of control, said processor is operative to cause saidadditional transmitting device to transmit a signal representing saidflight information.
 75. The apparatus defined in claim 73, wherein (I)said memory is further operative to store flight information, concerningthe actual flight activity of said aircraft, including at least one of:(a) the actual course of the flight of said aircraft, (b) the waypointsalong the route of said actual course, (c) the actual arrival time forat least one point along said actual course, (d) the actual ground speedfor said flight, and (e) the actual loitering time at a vicinity alongthe course of said flight; (II) said processor is operative to compareat least one of (a) the actual and the intended courses of the flight ofsaid aircraft, (b) the waypoints along the route of said actual coursewith the waypoints along the route of said intended course, (c) theactual and intended arrival times for at least one point along saidactual course, (d) the actual and intended ground speed for said flight,and (e) the actual and intended loitering time at a vicinity along thecourse of said flight; and (III) upon receipt of a sixth controlinstruction from said second source of control, said processor isoperative to cause said additional transmitting device to transmit atleast one signal representing the results of said comparison of saidactual flight information with said intended flight plan information.76. The apparatus defined in claim 69, wherein said memory is operativeto store communications information concerning at least one of: (a) atleast one frequency for transmission utilized by said transmittingdevice, (b) at least one frequency for receiving utilized by said atleast one receiving device, (c) at least one method of encryptionutilized by said transmitting device, (d) at least one method ofdecryption utilized by said at least one receiving device, (e) at leastone communications protocol utilized by said transmitting device, and(f) at least one communications protocol utilized by said at least onereceiving device, wherein, upon receipt of a communications controlinstruction from said second source of control, said processor isoperative to cause said additional transmitting device to transmit asignal representing said communications information.
 77. The apparatusdefined in claim 69, wherein said memory, said processor and saidtransmitting device are surrounded by at least one tamper detectingseal, coupled to said processor, for detecting unauthorized access to atleast one of said memory, said processor and said transmitting device,wherein (a) said at least one seal is further operative to signal saidprocessor upon the breach of said seal; and (b) said processor isoperative to cause said transmitting device to transmit a signalrepresenting the breach of said at least one seal.
 78. The systemdefined in claim 64, wherein (a) at least one of said actuators isoperative to interrupt the fuel supply to said engine; (b) said at leastone receiving device is operative to receive a signal representing anseventh control instruction, and (c) upon receipt of said seventhcontrol instruction, said processor is operative to cause said at leastone actuator to interrupt the fuel supply to said engine; thereby toallow for the termination of the flight of said aircraft.
 79. The systemdefined in claim 64, wherein said aircraft further comprisesself-destruction means, coupled to said processor, for destroying saidaircraft, and wherein (a) said at least one receiving device isoperative to receive a signal representing an eighth controlinstruction, and (b) upon receipt of eighth control instruction, saidprocessor is operative to activate said self destruction means; wherebysaid second source of control causes the destruction of said aircraft.80. The system defined in claim 67, further comprising a relay unitcomprising: (a) third T/R device, for communication with said second T/Rdevice of said second unit; (b) a fourth T/R device, for communicationwith each of said at least one receiving device and said additionaltransmitting device aboard said aircraft; and (c) a processor, coupledto each of said third T/R device and said fourth T/R device; whereinsaid processor causes (i) said third T/R device to retransmitinformation received by said fourth T/R device, and (ii) said fourth T/Rdevice to retransmit information received by said third T/R device. 81.The system defined in claim 80, wherein said relay unit is aboard asecond aircraft in proximity to said aircraft.
 82. The system defined inclaim 81, wherein the communications between said fourth T/R device andeach of (1) said at least one receiving device and (2) said additionaltransmitting device aboard said aircraft, is highly directional therebyreduce the likelihood of interception by an unauthorized person.
 83. Thesystem defined in claim 67, wherein said second T/R device is aboard athird aircraft in proximity to said aircraft.
 84. The system defined inclaim 83, wherein the communications between said second T/R device andeach of (1) said at least one receiving device and (2) said additionaltransmitting device aboard said aircraft, is highly directional.
 85. Thesystem defined in claim 67, wherein said second remote control unitfurther comprises a second memory, coupled to said second processor, forstoring flight plan information, concerning the intended flight activityof said aircraft, including at least one of: (a) the intended course ofthe flight of said aircraft, (b) the waypoints along the route of saidintended course, (c) the intended arrival time for at least one pointalong said actual course, (d) the intended ground speed for said flight,and (e) the intended loitering time at a vicinity along the course ofsaid flight; (II) said processor is further operative to compare saidstored flight plan information with actual flight information comprisingat least one of (a) the actual and the intended courses of the flight ofsaid aircraft, (b) the waypoints along the route of said actual coursewith the waypoints along the route of said intended course, (c) theactual and intended arrival times for at least one point along saidactual course, (d) the actual and intended ground speed for said flight,and (e) the actual and intended loitering time at a vicinity along thecourse of said flight; and (III) said second processor is furtheroperative to cause said second display device to display arepresentation of the difference between said flight plan informationand said actual flight information; thereby to display a representationof the deviation of the actual flight of said aircraft from the intendedflight of said aircraft.